-
Bug
-
Resolution: Unresolved
-
Low
-
Minor
-
Issue Summary
This is reproducible on Data Center: (no)
Anonymously accessible REST endpoints allow invalid user credentials to be used.
According to documentation, 401 Unauthorized should be returned for any unauthenticated requests.
Returned if the authentication credentials are incorrect or missing.
However, if we pass invalid credentials, we get 200 OK response.
curl -I --user foo:bar 'https://sitename.atlassian.net/rest/api/2/field'
HTTP/2 200
content-type: application/json;charset=UTF-8
This is counterintuitive and doesn't match the documentation.
Some APIs that are not anonymous accessible:
/rest/api/3/mypermissions
/rest/api/3/project/search
/rest/api/3/issue/bulkfetch
/rest/api/3/issue/field
Steps to Reproduce
- make a request to an anonymous accessible REST endpoint with invalid credentials
Expected Results
401 Unauthorized should be returned. According to documentation, when credentials are incorrect.
Actual Results
200 OK response is returned.
Workaround
Invalid credentials are treated as anonymous access. So, creadentials should be validated with an API endpoint that is not anonymous accessible. For example, /rest/api/2/myself.